Closed Bug 1169979 Opened 9 years ago Closed 9 years ago

crash in mozilla::dom::workers::XMLHttpRequest::Open(nsACString_internal const&, nsAString_internal const&, bool, mozilla::dom::Optional<nsAString_internal> const&, mozilla::dom::Optional<nsAString_internal> const&, mozilla::ErrorResult&)

Categories

(Core :: General, defect)

Product:
Core
Component:
General
Version:
41 Branch
Platform:
x86
Windows 7
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1169867
Tracking Flags:
Tracking Status
firefox41 --- affected

People

(Reporter: alice0775, Unassigned)

References

Details

(4 keywords)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-119076da-e55c-4606-8414-64ff52150531.
=============================================================

Crash while navigates Google Maps
[Tracking Requested - why for this release]: Regression causing crashes.

This is a regression from bug 1166924.

In particular, this bit in XMLHttpRequest::Open:

   if (!runnable->Dispatch(mWorkerPrivate->GetJSContext())) {
     ReleaseProxy();
     mProxy->mOpening = false;

will cause a null-deref crash if reached, since ReleaseProxy sets mProxy to null, right?
Blocks: CVE-2015-2722
tracking-firefox41: --- → ?
Flags: needinfo?(amarchesini)
Keywords: regression
[Tracking Requested - why for this release]: Looks like bug 1166924 got backported to various branches....
tracking-firefox39: --- → ?
tracking-firefox40: --- → ?
tracking-firefox-esr38: --- → ?
Group: core-security
Flags: needinfo?(amarchesini)
You are right. I already fixed this bug in another bug.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
Crash Signature: [@ mozilla::dom::workers::XMLHttpRequest::Open(nsACString_internal const&, nsAString_internal const&, bool, mozilla::dom::Optional<nsAString_internal> const&, mozilla::dom::Optional<nsAString_internal> const&, mozilla::ErrorResult&)] → [@ mozilla::dom::workers::XMLHttpRequest::Open(nsACString_internal const&, nsAString_internal const&, bool, mozilla::dom::Optional<nsAString_internal> const&, mozilla::dom::Optional<nsAString_internal> const&, mozilla::ErrorResult&)] [@ mozilla::dom::wor…
Group: core-security → core-security-release
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.